2

As the title states: Why do large companies such as router developers intentionally build in backdoors into their product when it can completely destroy the company’s reputation and cause a major security risk?

I currently both live in Sweden and Norway where building in backdoors are not forced by any agency or the government (AFAIK) so I really can't see the point in doing it.

closed as primarily opinion-based by Stephane, M'vy, Iszi, Xander, Rory Alsop Mar 9 '15 at 15:32

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

  • Suggested revision "What LEGITIMATE NEED do vendors have for built-in backdoors?" – Paraplastic2 Mar 9 '15 at 15:48
  • Depending on the hardware or software, the backdoor concept might hail from a previous version, company culture, or a need to have varying levels of access to the system. For example, an embedded systems manufacturer might have secret commands to control their device, but don't want to share with their partners who sell and install it to reduce support requests when said partners mess it up. But the tech support and/or repair facility needs that access. – YetAnotherRandomUser Mar 26 at 1:59
6

There are several ways how a backdoor can get into a product.

  1. The company is forced to do so by the law of the country where they have their company headquarter. When you live in Sweden or Norway, then most of the electronic devices you use will likely be imported from China (I just looked for some device connected to my computer which did not have a "Made in China" sticker - I couldn't find one) while most of the software you use will be imported from the United States (with help from programmers from India). When the companies are forced by their local government to backdoor their devices for export, they will certainly not remove the backdoors or tell retailers about them when the products leave the country. Keeping them backdoored is the whole purpose of this, and the local laws usually forbid the companies from disclosing the backdoors. This prohibition also serves as a PR rescue system for the involved companies. When caught they can say that they had no choice and can put all the blame on their government.
  2. The company management is unaware of the backdoor. It was either introduced accidentally (an honest security bug) or intentionally by an employee who was bribed, extorted, otherwise manipulated by a 3rd party or thought that it might serve their own personal interest to have a backdoor in their product only they know about. In practice, accidental backdoors are much more likely (Hanlon's Razor: "Never attribute to malice that which can be adequately explained by stupidity").
  3. The company management is aware of the backdoor, and considers it a legitimate feature. A possible situation is a remote administration interface which is supposed to make it easier to handle customer support requests. Such a feature seems really useful from a laymans perspective. Imagine your router doesn't work, you call the support number, just read them the serial number and they fix it remotely without you having to do any of that difficult computery stuff. Sounds great, doesn't it? Unfortunately managers lack the technical expertise to understand how difficult it is to implement something like this in a way which makes it secure but still convenient for the support staff and end-user. In some companies, management will be primarily concerned with minimizing the minutes per handled customer support request and meeting the deadline, so security considerations will often have low priority.
  • 1
    Good points. One other scenario is the company didn't put the backdoor there but a third party compromised the supply chain and changed the hardware/software before the shipment. I still blame the company if they haven't provided an interface through which the customer can check integrity of the product but still this is a case we have seen exploited in the real world as well. – void_in Mar 9 '15 at 14:26

Not the answer you're looking for? Browse other questions tagged or ask your own question.